diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-04-18 13:09:09 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-04-18 13:09:09 +0300 |
| commit | eef784ac6a72a8223fe094f79c72d58d8d91a4d0 (patch) | |
| tree | 6e276b20bcf675fe6b170a2a3fc1ecc12599a1ac | |
| parent | 3f4cea474e488dfbe892e833deace49b4c8be513 (diff) | |
| download | community.vyos.net-eef784ac6a72a8223fe094f79c72d58d8d91a4d0.tar.gz community.vyos.net-eef784ac6a72a8223fe094f79c72d58d8d91a4d0.zip | |
Address Copilot review: preconnect order + staging-gate cookies-policy script
Two fixes flagged by the Copilot reviewer on #35:
1. Preconnect hints were appended to the end of <head> while the GTM
loader is prepended to the top, so GTM's async script creation
fired before the browser ever saw the preconnect tags — they
provided no benefit. Switches insert-preconnect-hints to
prepend_child and adds `after = "insert-google-tag-manager-head"`
so the widget runs after GTM and its prepend pushes GTM down to
position 1. Result: preconnects land at the top of <head>, ahead
of the GTM loader.
2. The Cookiebot cd.js script embedded directly in
site/legal/cookies-policy.md rendered on every profile, so a
staging visitor who hit /legal/cookies-policy/ would leak their
IP to consent.cookiebot.com. Replaces the inline <script> with a
<div id="cookie-declaration-placeholder"></div> and adds a new
insert-cookiebot-declaration widget (profile = "live", page =
"legal/cookies-policy.md") that replaces the placeholder with
the real script element only on live builds. Staging now emits
zero Cookiebot markup on the cookies-policy page.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
| -rw-r--r-- | site/legal/cookies-policy.md | 5 | ||||
| -rw-r--r-- | soupault.toml | 17 |
2 files changed, 17 insertions, 5 deletions
diff --git a/site/legal/cookies-policy.md b/site/legal/cookies-policy.md index cfc4427..1984219 100644 --- a/site/legal/cookies-policy.md +++ b/site/legal/cookies-policy.md @@ -4,7 +4,4 @@ This page lists the cookies set by vyos.net. Cookie data is maintained automatic For the VyOS privacy policy covering all VyOS properties, see [vyos.io/legal/privacy-policy](https://vyos.io/legal/privacy-policy). -<script id="CookieDeclaration" - src="https://consent.cookiebot.com/<CBID>/cd.js" - type="text/javascript" - async></script> +<div id="cookie-declaration-placeholder"></div> diff --git a/soupault.toml b/soupault.toml index 7c41812..8d1e6de 100644 --- a/soupault.toml +++ b/soupault.toml @@ -78,7 +78,22 @@ height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript> <link rel="preconnect" href="https://consent.cookiebot.com" crossorigin /> """ selector = "head" - action = "append_child" + action = "prepend_child" + after = "insert-google-tag-manager-head" + profile = "live" + +# The Cookiebot CookieDeclaration script is injected only on live builds so +# staging visitors who hit /legal/cookies-policy/ don't leak their IP to +# consent.cookiebot.com. The markdown source contains a placeholder div +# (#cookie-declaration-placeholder) that this widget replaces in place. +[widgets.insert-cookiebot-declaration] + widget = "insert_html" + page = "legal/cookies-policy.md" + html = """ +<script id="CookieDeclaration" src="https://consent.cookiebot.com/<CBID>/cd.js" type="text/javascript" async></script> +""" + selector = "#cookie-declaration-placeholder" + action = "replace_element" profile = "live" # Inserts a scary warning banner in preview versions |